Extract year from date field and assign to new field

[manideep]

Hi All,

is there a way to extract year from date field and assign to new field?

I want to update existing mapping with new field or i can re-index with new new mapping as well.

Please suggest.

[Glen_Smith]

Manideep,

First, I infer that you already have these documents indexed, and that the optimal solution would let you reprocess them right in the cluster.

Yes, you can do this using an Ingest Pipeline.

Assuming your existing date field is in some consistent, structured form, I think the key for what you describe will be the Grok Processor. You'll define a pattern that captures the year from the existing field and maps it to a new field.

Of course this pipeline will also work with new documents that you index.